The Indian Banks' Association (IBA) is working on a structured mechanism for its member banks to share information about cyber security incidents with each other, so that the moment one bank is attacked, the others can take remedial measures immediately, SBI Chairman Challa Sreenivasulu Setty said on Tuesday (November 3).

Source: The Hindu BusinessLine

"While it (a cyber security incident) is definitely shared with the regulators and the security agencies, among the banks… the moment an incident happens, if it can be informed through a structured mechanism, I think that would be quite useful so that people can immediately take (remedial) measures. This is something we are seriously working on under the aegis of IBA," Setty, who is also Chairman of the IBA, said in reply to questions on cyber security at the bank's second-quarter results press meet.

Source: The Hindu BusinessLine

Speaking separately to IANS, Setty said SBI is actively engaging with other stakeholders through the IBA to ensure a coordinated response to cyber risks across the banking, financial services and insurance (BFSI) sector, and is examining how artificial intelligence can be used to fight AI-driven threats.

Source: IANS

The push follows last month's incident at SBI itself, in which the country's largest bank said a suspected exposure of customer data on the dark web had been detected. In a preliminary analysis of approximately 3,75,000 records available on the dark web, 3,897 customer records containing personally identifiable information were identified, according to the bank's exchange filing.

Source: The Hindu BusinessLine

On that breach, Setty said the bank had given information in the press and reached out to customers, and that a root-cause analysis is under way. "Our focus was in terms of containment measures and also identify the vulnerabilities which led to this breach and remediate them," he said, adding that SBI has undertaken a complete cyber security drill including an API sweep, and that vulnerability assessment is an ongoing process.

Source: The Hindu BusinessLine

Setty said that as digitalisation in banking grows, the attack surface is also increasing, and that digital adoption and security need not be mutually exclusive. He pointed to agencies such as CERT-In and the National Critical Information Infrastructure Protection Centre (NCIIPC), which engage with the whole ecosystem, as a strength of India's public-private partnership model.

Source: The Hindu BusinessLine

No timeline for the IBA mechanism has been announced. Setty said there has never been a shortage of funds for technology and digital solutions at SBI, and that the incidents have strengthened the bank's resolve to ensure its cyber security measures are strong enough to prevent further breaches.